The massive data breach at Target over the holiday season is potentially much worse than the retailer first reported — as many as 110 million people may have had their identity and financial information compromised, the retailer says.

It remains unclear just how many individuals are affected and how. The company’s ongoing investigation found that up to 70 million people had personal information stolen in the breach; in December, Target disclosed that 40 million accounts had been hacked.

The amount of overlap between the two figures — 70 million and 40 million — is uncertain. Target averages 30 million customers a week.

The retailer said Friday that “the stolen information includes names, mailing addresses, phone numbers or e-mail addresses for up to 70 million individuals.”